Quickly determine the validity and scope of a GitHub access token.

ghcheck

#!/bin/bash

GREEN='\033[0;32m'
RED='\033[0;31m'
END='\033[0m'

request=$(curl -s -u "hehe:$1" https://api.github.com/user)
name=$(echo "$request" | jq -r ".login" 2> /dev/null)
if [[ $name == "null" ]]; then
	echo -e "${RED}Not a GitHub access token.${END}"
	exit 1
fi
org=$(curl -s -H "Authorization: token $1" "https://api.github.com/users/$name/orgs" | jq -r ".[].login" 2> /dev/null)
scope=$(curl -s -H "Authorization: token $1" "https://api.github.com/users/$name" -I | grep -i "X-OAuth-Scopes:")

if [[ $org || $scope ]]; then
	echo -e "Status: ${GREEN}Vulnerable${END}"
	echo "Username: $name"
	echo "Organisation(s): $org"
	echo "Scope: $scope"
else
	echo -e "Status: ${RED}Not vulnerable${END}"
        echo "Username: $name"
        echo "Organisation(s): $org"
        echo "Scope: $scope"
fi